Because the Commonwealth of Pennsylvania does not have a comprehensive consumer privacy law, it relies on a patchwork of other laws and regulations to protect its citizens’ information from unwanted access, collection and use. Including Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, 18 Pa. CS § 5701 onwards. (WESCA) is at the center of a recent decision resulting from a third-party marketing company’s covert interception of a consumer’s communications while she was shopping online.
In dad from Harriet Carter Gifts, Inc. and NaviStone, Inc. the Third Circuit determined that an interception did indeed occur under WESCA, but could not determine where — a critical question since WESCA does not apply to behavior outside of Pennsylvania. Importantly, the Third Circuit has not taken a complete swipe at third-party use of cookies or collection of marketing data by acknowledging several WESCA exceptions, including consent from all parties, and reiterating the importance of the Terms of Service and Privacy Policy.
background
Plaintiff Ashley Popa navigated to the Harriet Carter Gifts website on her iPhone to search for pet stairs. Popa ended up adding a set to her shopping cart and started the checkout process, but didn’t complete it. As she clicked through the site, Popa’s browser unsurprisingly communicated with Harriet Carter, but also secretly interacted with NaviStone, a third-party marketing service Harriet Carter hired. Popa left Harriet Carter’s website without buying anything, but not before NaviStone had sent a “OneTag” code to her browser, which allowed it to collect, among other things, pages Popa visited when she checked her email address entered and items she added to her shopping cart.
Popa filed a lawsuit in the Western District of Pennsylvania alleging that Harriet Carter and NaviStone violated WESCA and common law violations of privacy. (On appeal, the Third Circuit recognized that WESCA grants individuals a private right of action, meaning consumers can bring claims for alleged violations without waiting for state or regulatory action.) The district court quickly dismissed the privacy violation lawsuit and later entered summary judgment in favor of defendants with respect to the WESCA complaint. Popa appealed the Third Circuit’s dismissal of her WESCA lawsuit.
Third Circuit Appeals Process
Popa’s appeal depended on whether NaviStone “intercepted” her communications with Harriet Carter under the law, which “prohibits the interception of any communications, whether wired, electronic or oral, meaning it is unlawful to use a device to capture those communications.” The Third Circuit first recognized that in the context of wiretapping in the context of WESCA, “wiring” is defined as “capturing specific communications using a device.” While the issue sounds simple, unlike the days of traditional phone wiretapping, the Third Circuit had to consider technical evidence that didn’t just address whether the JavaScript code used by NaviStone to communicate directly with its server was in fact a wiretapping under WESCA , but also where the interception took place. Interestingly, the defendants did not question whether such a code was a “device” within the meaning of the law.
The Third Circuit rejected the defendants’ main argument that Pennsylvania courts had exempted direct recipients of communications from WESCA’s guilt. In doing so, it noted that the inventories of criminal suppression cases relied on by the defendants were later codified in amendments to WESCA that protected law enforcement officials from liability for wiretapping when they are an “intended recipient” or identify themselves as an “intended recipient.” ” spend. It was noted that the Pennsylvania Legislature had the option, but refrained from adopting more expansive language to define intended recipients.
The Third Circuit found that the Pennsylvania Supreme Court would find that WESCA did not provide a comprehensive direct party exemption and that the defendants could not avoid liability because Popa’s browser “unknowingly communicated directly with NaviStone’s servers.” In a broader context, the Third Circuit acknowledged in footnote 6 that this conflicts with its view in cases brought under the Federal Wiretap Act, which contains an explicit exemption for direct parties. For example in Regarding Google Inc. Cookie Placement Consumer Privacy Litigation And Regarding Nickelodeon Consumer Privacy Disputesthe plaintiffs’ browsers sent GET requests directly to the defendants, turning them into parties to communications under the federal wiretapping law.
The Third Circuit then turned its attention to determining where NaviStone intercepted Popa’s communications, a critical question here because WESCA is not requesting conduct entirely outside of Pennsylvania. In other words, if the wiretapping took place in Virginia, where NaviStone’s servers are located, a court would have to conduct an electoral law analysis to determine whether WESCA made a request. The Third Circuit determined that NaviStone’s interception occurred in Popa’s browser, not where NaviStone was directing the communications. Although the parties believed the interception took place in Pennsylvania, the Third Circuit found no support in the records to determine where Popa’s browser met Harrier Carter’s website and where NaviStone’s code began instructing their browser to use his servers to communicate.
The Third Circuit remanded the case to the district court to determine if there is a genuine issue of material fact as to where the interception took place.
The Third Circuit also noted that WESCA does not knee-jerk prohibit the use of cookies or the use of third-party marketing companies for data collection, as this includes a number of exceptions. For example, the “all-party consent exception,” which sounds like it allows parties to pre-consent to wiretapping. The defendants gave their consent, alleging that because Harriet Carter’s website contained a privacy policy that allegedly disclosed that communications were being sent to a third-party company, Popa had impliedly consented. That question is still before the District Court and will focus on whether the privacy policy of the web browser accessed by the plaintiff adequately informed her of the interception.
Diploma
The father The opinion underscores the need for Pennsylvania businesses and digital marketing companies offering services in the Commonwealth to obtain consumer consent before collecting their data or installing cookies on a browser. It is also emphasized that courts will give broad meaning to what is “interception” of a communication under WESCA. This could set a precedent for similar cases in court pending enactment of a comprehensive privacy law in the Commonwealth of Pennsylvania.